Default / hardcoded IoT credentials
Guessable or unchangeable passwords enable mass compromise
categoryWireless, mobile, IoT and OT/ICS attacksseverityHighdetectability (measured in our lab)Mediumlabdetected in lab
Example: Unitronics "1111"
Detection opportunity what to watch for
A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.
What the attacker runs
powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1078.001 -Tool atomic -RunId <run-id> -Command 'Invoke-AtomicTest T1078.001 -TestGuids aa6cb8c4-b582-4f8e-b677-37733914abda -TimeoutSeconds 120'powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1078.001 -Tool atomic -RunId run-2026-10-14-019 -Command 'Invoke-AtomicTest T1078.001 -TestGuids aa6cb8c4-b582-4f8e-b677-37733914abda -TimeoutSeconds 120'powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1078.001 -Tool atomic -RunId run-2026-10-16-007 -Command 'Invoke-AtomicTest T1078.001 -TestGuids aa6cb8c4-b582-4f8e-b677-37733914abda -TimeoutSeconds 120'+ 2 more test variant(s) in the corpus.
What our lab measured
detected windows · 2026-10-27 · detected in 42s
What it looked like in telemetry
| Log source | What it means |
|---|---|
| Sysmon · EID 1 | Default account re-activation: net user ... /active:yes (enabling a disabled account, e.g. Guest) |
| Sysmon · EID 1 | Suspicious Windows cmd shell execution |
| Sysmon · EID 1 | Windows command prompt started by an abnormal process |
| Sysmon · EID 11 | Executable file dropped in folder commonly used by malware |
| PowerShell · EID 4104 | Powershell script querying system environment variables |
| PowerShell · EID 4104 | Powershell script recursively collected files from a filesystem search |
| PowerShell · EID 4104 | Powershell script searching filesystem |
| PowerShell · EID 4104 | Powershell script used "Invoke-command" cmdlet to execute sub script |
| … and 7 more event type(s) | |
Detection that fired
- ✓ Wazuh
100403(level 10) lab rule — Default account re-activation: net user ... /active:yes (enabling a disabled account, e.g. Guest)
Plus 14 stock Wazuh/Sysmon rule(s) in the window.
Background noise in the window: ~70085 incidental alerts/hour — tune against this.
detected windows · 2026-10-18 · detected in 40s
What it looked like in telemetry
| Log source | What it means |
|---|---|
| Sysmon · EID 1 | Access token manipulation: SYSTEM-integrity process created by a non-service parent |
| Sysmon · EID 1 | Default account re-activation: net user ... /active:yes (enabling a disabled account, e.g. Guest) |
| Sysmon · EID 1 | Suspicious Windows cmd shell execution |
| Sysmon · EID 1 | Windows command prompt started by an abnormal process |
| Sysmon · EID 11 | Executable file dropped in folder commonly used by malware |
| PowerShell · EID 4104 | Powershell script querying system environment variables |
| PowerShell · EID 4104 | Powershell script recursively collected files from a filesystem search |
| PowerShell · EID 4104 | Powershell script searching filesystem |
| … and 8 more event type(s) | |
Detection that fired
- ✓ Wazuh
100230(level 10) lab rule — Access token manipulation: SYSTEM-integrity process created by a non-service parent - ✓ Wazuh
100403(level 10) lab rule — Default account re-activation: net user ... /active:yes (enabling a disabled account, e.g. Guest)
Plus 14 stock Wazuh/Sysmon rule(s) in the window.
Background noise in the window: ~57332 incidental alerts/hour — tune against this.
Classification
41 values: 2 lab-measured, 26 imported, 4 derived, 9 machine-classified. What do these mean?
Exploitability
| Attack vector | Credential attacksMisconfigurationSoftware vulnerabilitiesWireless, mobile & IoT/OT |
|---|---|
| Reach (CVSS) | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Attacker skill required | Low |
| Resources required | Low |
| Likelihood / prevalence | Medium |
| Maturity | Commoditized |
Impact & scope
| Severity | High |
|---|---|
| Impact | AvailabilityConfidentialityIntegrity |
| Platform | ContainersESXiIaaSIdentity ProviderLinuxmacOSNetwork DevicesOffice SuiteSaaSWindows |
| Environment | Edge / IoT |
| Target asset class | EndpointNetwork device |
| Kill-chain phase (tactic) | Initial AccessPersistencePrivilege EscalationStealth |
Detection & telemetry
| Detectability (measured in our lab) | Medium |
|---|---|
| Detectability (public detection content) | High |
| Noise level | High |
| Testability | Atomic Red Team test |
| Data sources (ATT&CK data components) | Logon Session CreationUser Account Authentication |
| Attack permissions (ATT&CK) | AdministratorUser |
Detection & response
Mitigated by 9
- M1027 attack-mitigation
- M1032 attack-mitigation
D3-AAd3fendD3-ALd3fendD3-AMd3fendD3-CDPd3fendD3-RUAAd3fendD3-UAPd3fendD3-ULAd3fend
Detected by 6
- DET0465 attack-detection-strategy
0f63e1ef-1eb9-4226-9d54-8927ca08520asigma821bcf4d-46c7-4b87-bc57-9509d3ba7c11sigma917789e1-2c1f-4bf5-8c91-6f71a017f469sigmad7329412-13bd-44ba-a072-3387f804a106sigma100403wazuh
Tested by 3
0315bdff-4178-47e9-81e4-f31a6d23f7e4atomic99747561-ed8d-47f2-9c91-1e5fde1ed6e0atomicaa6cb8c4-b582-4f8e-b677-37733914abdaatomic
Attack relationships
- Parent: Compromised insider
- Parent: Vendor credential abuse
Lab findings
Measured in the isolated detection lab (Wazuh / Sysmon / auditd). Each run detonates a benign emulation of the technique and grades what the SIEM saw.
| Run | Outcome | Tool | Platform | Ran at |
|---|---|---|---|---|
run-2026-10-14-019 | partially-detected | atomic | windows | 2026-10-14 |
run-2026-10-16-007 | detected | atomic | windows | 2026-10-16 |
run-2026-10-18-020 | detected | atomic | windows | 2026-10-18 |
run-2026-10-27-014 | detected | atomic | windows | 2026-10-27 |
run-2026-10-14-019— Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=3). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1078.001 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=18 max_level=15 dwell_s=90run-2026-10-16-007— Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=3). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1078.001 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=2 incidental=15 max_level=15 dwell_s=90run-2026-10-18-020— Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=3). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1078.001 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=2 incidental=1497 max_level=15 dwell_s=90run-2026-10-27-014— Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=3). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1078.001 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=2 incidental=1830 max_level=15 dwell_s=90
Framework references
- Primary source: https://owasp.org/www-project-internet-of-things/
- owasp-iot: I1 (primary)
- cwe: CWE-1392
- cwe: CWE-798
- capec: CAPEC-70
- attack: T1078.001
Evidence & sources
- ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Wireless, mobile, IoT and OT/ICS attacks' table, line 491 of Cyber-Attack-Taxonomy.md
- ev-0002 (Seeded-record enrichment run 2026-09-30 (crosswalk + facet classification)) — Crosswalk to cwe:CWE-1392, cwe:CWE-798, capec:CAPEC-70, attack:T1078.001 as the nearest framework entries; ids verified to exist in the cached catalogues.
- ev-0003 (CAPEC — Common Attack Pattern Enumeration and Classification 3.9) — CAPEC-70 Try Common or Default Usernames and Passwords: CAPEC prerequisites for this pattern
The system uses one factor password based authentication.The adversary has the means to interact with the system.
- ev-0004 (MITRE Common Weakness Enumeration (CWE) 4.20) — Linked to CWE-1392 'Use of Default Credentials', a CWE Base-level weakness (CWE 4.20).
Use of Default Credentials
- ev-0005 (MITRE Common Weakness Enumeration (CWE) 4.20) — Linked to CWE-798 'Use of Hard-coded Credentials', a CWE Base-level weakness (CWE 4.20).
Use of Hard-coded Credentials
- ev-0006 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 7 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
- ev-0007 (Phase 4 detection lab - detonation runs 2026-10-14) — Lab detonation run-2026-10-14-019 (partially-detected) for T1078.001: no alert matched the expected technique
- ev-0008 (Phase 4 detection lab - detonation runs 2026-10-16) — Lab detonation run-2026-10-16-007 (detected): Wazuh rule(s) 100403 fired on T1078.001 within the detonation window
Default account re-activation: net user ... /active:yes (enabling a disabled account, e.g. Guest)
- ev-0009 (Phase 4 detection lab - detonation runs 2026-10-18) — Lab detonation run-2026-10-18-020 (detected): Wazuh rule(s) 100403 fired on T1078.001 within the detonation window
Default account re-activation: net user ... /active:yes (enabling a disabled account, e.g. Guest)
- ev-0010 (Phase 4 detection lab - detonation runs 2026-10-27) — Lab detonation run-2026-10-27-014 (detected): Wazuh rule(s) 100403 fired on T1078.001 within the detonation window
Default account re-activation: net user ... /active:yes (enabling a disabled account, e.g. Guest)